And I think the tags and headers in my tests were only applied to infected messages, while the checked-clean ones remained unchanged. I am not sure if it is by design or my misconfiguration, we did not pursue this further.